CVE-2023-0400: Trellix DLP Auth Bypass Vulnerability

CVE-2023-0400 Overview

A protection bypass vulnerability exists in Trellix Data Loss Prevention (DLP) for Windows version 11.9.x that allows local users to circumvent DLP security controls. The vulnerability specifically enables attackers to upload sensitive data from mapped network drives to web-based email clients, effectively bypassing the data exfiltration protections that DLP is designed to enforce.

Critical Impact

Local users can bypass DLP controls to exfiltrate sensitive data via mapped drives to web email clients, potentially resulting in unauthorized disclosure of confidential information and regulatory compliance violations.

Affected Products

• Trellix Data Loss Prevention versions 11.9.x (prior to 11.10.0)
• Microsoft Windows (as the underlying operating system)
• DLP endpoint agents deployed on Windows systems with mapped network drives

Discovery Timeline

• 2023-02-02 - CVE CVE-2023-0400 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-0400

Vulnerability Analysis

The vulnerability stems from inconsistent handling of file access controls between local drives and mapped network drives within the DLP monitoring subsystem. While the DLP agent correctly intercepts and blocks sensitive data uploads originating from local drives, it fails to apply the same level of scrutiny to data sourced from mapped network drives (e.g., drives mounted via SMB/CIFS protocols).

This behavioral inconsistency creates a security gap where the DLP agent's file monitoring hooks do not properly enumerate or track file operations when data is read from mapped drives and subsequently uploaded through web browser interfaces to email services. The CWE-670 (Always-Incorrect Control Flow Implementation) classification indicates a fundamental logic flaw in how the control flow determines which file operations require DLP policy enforcement.

Additionally, the CWE-427 (Uncontrolled Search Path Element) designation suggests that the vulnerability may involve how the DLP agent resolves file paths, potentially failing to canonicalize or properly validate paths that reference mapped drives.

Root Cause

The root cause lies in the DLP agent's file system monitoring component, which implements different code paths for local versus network-mapped drives. The monitoring logic in version 11.9.x incorrectly assumes that mapped drives do not require the same level of content inspection as local drives during upload operations to web applications. This is a control flow implementation error where the conditional logic that triggers DLP scanning fails to account for mapped drive scenarios.

Interestingly, versions prior to 11.9 handled this scenario correctly, suggesting a regression was introduced in the 11.9.x release cycle that modified the file access monitoring behavior.

Attack Vector

The attack requires local access to a Windows system with the vulnerable Trellix DLP agent installed. An attacker with legitimate user credentials can exploit this vulnerability through the following general approach:

1. The attacker maps a network drive containing sensitive data to their Windows workstation
2. They navigate to a web-based email client in their browser
3. When composing an email with an attachment, they select files from the mapped drive
4. The DLP agent fails to inspect or block the upload operation
5. Sensitive data is successfully exfiltrated via the email attachment

This bypass does not require elevated privileges and can be performed by any authenticated local user. The attack is particularly concerning in enterprise environments where users commonly access shared network resources through mapped drives.

Detection Methods for CVE-2023-0400

Indicators of Compromise

• Unusual file upload activity from mapped network drives to web-based email services
• DLP policy alerts that trigger for local drives but show gaps for mapped drive operations
• Browser processes uploading files with paths referencing network drive letters (e.g., Z:\, Y:\)
• Increased outbound HTTP/HTTPS traffic to webmail domains containing attachment data

Detection Strategies

• Monitor for file access patterns involving mapped drives followed by network uploads to known webmail services
• Implement network-level DLP as a compensating control to detect sensitive data leaving the network
• Audit Trellix DLP agent versions across endpoints to identify systems running vulnerable 11.9.x versions
• Deploy endpoint detection rules that correlate mapped drive file reads with subsequent browser upload activities

Monitoring Recommendations

• Enable verbose logging on Trellix DLP agents to capture all file access operations including mapped drive activity
• Implement SIEM rules to detect anomalous data transfer patterns from endpoints running vulnerable DLP versions
• Configure SentinelOne Singularity to monitor file system operations and network uploads for data exfiltration indicators
• Review DLP policy violation logs for inconsistencies that may indicate the bypass is being exploited

How to Mitigate CVE-2023-0400

Immediate Actions Required

• Upgrade Trellix Data Loss Prevention to version 11.10.0 or later immediately
• Conduct an inventory of all endpoints running DLP version 11.9.x and prioritize patching
• Implement compensating controls such as network-level DLP or web proxy content inspection
• Consider temporarily restricting mapped drive access for high-risk users until patches are deployed

Patch Information

Trellix has addressed this vulnerability in DLP version 11.10.0. Organizations should reference the Trellix Security Bulletin SB10394 for official patch information and upgrade instructions. The patch restores the correct behavior where DLP controls are applied consistently regardless of whether sensitive data originates from local or mapped drives.

Workarounds

• Temporarily disable mapped drive functionality for users handling sensitive data until the patch can be applied
• Implement network segmentation to restrict access to file shares containing sensitive data
• Deploy additional email security controls that can inspect outbound attachments at the mail gateway level
• Consider downgrading to a pre-11.9 version if immediate patching to 11.10.0 is not feasible (verify with Trellix support)

# Verify Trellix DLP agent version on Windows endpoints
# Run from elevated command prompt
wmic product where "name like '%Trellix%DLP%'" get name,version

# Check for mapped drives on the system
net use

# Review DLP service status
sc query "TrellixDLP"